Feat v0.7.7 API tokens + extension permissions (#61)

Personal access tokens (PATs) for programmatic API access with
SHA-256 hashing, permission scoping (git model), and Settings/Admin UI.
Extension-declared user permissions with dynamic registry, gate_permission
manifest field, permissions Starlark module, and grouped admin UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/groups.go

@@ -165,7 +165,7 @@ func (h *GroupHandler) UpdateGroup(c *gin.Context) {
 
 	// Validate permissions if provided
 	if patch.Permissions != nil {
-		valid := auth.AllPermissions
+		valid := auth.AllPermissionsWithExtensions()
 		validSet := make(map[string]bool, len(valid))
 		for _, p := range valid {
 			validSet[p] = true
@@ -433,7 +433,10 @@ func (h *GroupHandler) DeleteResourceGrant(c *gin.Context) {
 // ListPermissions returns all valid permission strings.
 // GET /api/v1/admin/permissions
 func (h *GroupHandler) ListPermissions(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{"permissions": auth.AllPermissions})
+	c.JSON(http.StatusOK, gin.H{
+		"permissions": auth.AllPermissionsWithExtensions(),
+		"grouped":     auth.AllPermissionsGrouped(),
+	})
 }
 
 // GetUserPermissions returns the effective permissions for a given user.